Repository navigation
Track the remaining Chromium .92 upstream vulnerabilities #13
Description
Chromium Sandbox 154.0.8037.92-1~deb13u1 still has five newer upstream vulnerabilities: CVE-2026-103622, CVE-2026-103624, CVE-2026-103625, CVE-2026-103626, and CVE-2026-103628. Two are Critical. These are separate from the older Chromium findings corrected by .92.
Google's official Linux fix is 154.0.8037.97. Debian Trixie has not published that package yet. v1.2.5 accepts these upstream vulnerabilities and keeps the full scanner reports. They are not fixed. Avoid untrusted browser content and automation while they remain.
Use the official Debian package when it becomes available. Keep the sandbox, seccomp profile, non-root user, and closed browser port intact. Do not patch or custom-build Chromium.
Close this only after a release installs the corrected Chromium, Chromium Common, and Chromium Sandbox packages on AMD64 and ARM64, both native browser smokes pass, fresh Trivy and Docker Scout reports no longer flag these five CVEs, and the verified images reach Docker Hub and GHCR version/latest tags. Update the release notes and site warning with the verified result.
Sources: Google release, Debian tracker, v1.2.5 dependency audit.
Activity
v1.2.6
v1.2.6
v1.2.6
CoderLuii commentedon Oct 15, 2026
Fixed in v1.2.7.
Chromium, Chromium Common and Chromium Sandbox are all
155.0.8059.39-1~deb13u1on AMD64 and ARM64. Both native browser checks passed, and fresh full Scout and Trivy reports no longer flag the five CVEs listed here. The release includes the reports and package inventories.Docker Hub and GHCR
1.2.7/latestall resolve to the validated indexsha256:b212036da5c9057e02e2b0680d66fd5164272d0c9e3ef82c1542589236bd1ed1. The release workflow passed, and the release notes and site warning are updated.The scanners still report 37 other Chromium CVEs. Those remain accepted upstream findings and are tracked separately in #14. Keep avoiding untrusted browser content and automation.